Merge "video: Added more validations"

driver/variant/iris2/src/msm_vidc_iris2.c

@@ -616,7 +616,7 @@ int msm_vidc_decide_work_route_iris2(struct msm_vidc_inst* inst)
 
 int msm_vidc_decide_quality_mode_iris2(struct msm_vidc_inst* inst)
 {
-	struct msm_vidc_inst_capability* capability = inst->capabilities;
+	struct msm_vidc_inst_capability* capability = NULL;
 	struct msm_vidc_core *core;
 	u32 mbpf, mbps, max_hq_mbpf, max_hq_mbps;
 	u32 mode;
@@ -626,6 +626,8 @@ int msm_vidc_decide_quality_mode_iris2(struct msm_vidc_inst* inst)
 		return -EINVAL;
 	}
 
+	capability = inst->capabilities;
+
 	if (!is_encode_session(inst))
 		return 0;
 

driver/vidc/inc/msm_vidc_internal.h

@@ -402,7 +402,7 @@ struct msm_vidc_inst_cap {
 struct msm_vidc_inst_capability {
 	enum msm_vidc_domain_type domain;
 	enum msm_vidc_codec_type codec;
-	struct msm_vidc_inst_cap cap[INST_CAP_MAX];
+	struct msm_vidc_inst_cap cap[INST_CAP_MAX+1];
 };
 
 struct msm_vidc_core_capability {

driver/vidc/src/venus_hfi_response.c

@@ -1101,6 +1101,12 @@ static int handle_session_property(struct msm_vidc_inst *inst,
 	i_vpr_h(inst, "%s: property type %#x\n", __func__, pkt->type);
 
 	port = vidc_port_from_hfi(inst, pkt->port);
+	if (port >= MAX_PORT) {
+		i_vpr_e(inst,
+				"%s: invalid port: %d for property %#x\n",
+				__func__, pkt->port, pkt->type);
+		return -EINVAL;
+	}
 	payload_ptr = (u32 *)((u8 *)pkt + sizeof(struct hfi_packet));
 
 	switch (pkt->type) {
@@ -1405,6 +1411,8 @@ static int queue_response_work(struct msm_vidc_inst *inst,
 	struct response_work *work;
 
 	work = kzalloc(sizeof(struct response_work), GFP_KERNEL);
+	if (!work)
+		return -ENOMEM;
 	INIT_LIST_HEAD(&work->list);
 	work->type = type;
 	work->data_size = hdr_size;